UK telcos may be fined £100,000/day for working with Huawei

The British Government has brought a new law into effect aimed at increasing the UK’s telecom network security standards and “removing the threat of high risk vendors”.

According to the Government, companies in breach of the new law may face heavy fines of up to 10% of their annual turnover, or - if they are found to be in direct violation - as much as £100,000 a day. 

The bill was signed into law by Parliament on Tuesday and involves strengthening the security framework for technology used in 5G and full fibre networks including the electronic equipment and software at phone mast sites and in telephone exchanges which handle internet traffic and telephone calls, according to a press statement from the Department for Digital, Culture, Media & Sport. 

The move also gives the Government broader national security powers regarding the use of products from “high risk” vendors in the country’s telecommunications infrastructure. Experts have identified the decision as the next step in the government’s plan to oust Chinese communications giant Huawei from the rest of the UK telecom industry, following its ban from the country’s 5G network core earlier this year. 

Until this week, Huawei almost looked as though it was in with a chance of continuing to operate in the UK. In the lead up to the announcement, the Government’s position was that Huawei would be able to supply a third of the equipment needed for future 5G networks in the UK. But this new law firmly slams the door on the Chinese firm. 

Huawei VP Victor Zhang said that he was “disappointed” by the Government’s decision, adding that “This decision is politically motivated and not based on a fair evaluation of the risks.”

The UK’s Digital Secretary Oliver Dowden has said that, in addition to targeting Huawei, the new law will be an important tool in the Government’s efforts to mitigate cyber threats across future generations of telecom infrastructure, including espionage attacks and networks being remotely disabled by state-sponsored operators. 

“We are investing billions to roll out 5G and gigabit broadband across the country, but the benefits can only be realised if we have full confidence in the security and resilience of our networks,” he said on Tuesday, adding that the “groundbreaking” bill would ensure the UK’s telecom security regime was “one of the toughest” in the world. 

However, some industry experts have questioned the necessity of the new bill. Jimmy Jones, Cyber Security Telecoms expert at Positive Technologies commented that, “While this legislation crystalises the penalties and locks the government's advice in a legal framework, if it is aimed at Huawei then I think the damage has already been done.” 

UK telecoms are already being required to phase out Huawei technology in their networks by 2027, following the ban in July, a fact which Jones asserts, has already caused many operators to look elsewhere. 

“The uncertainty has meant mobile operators have already had to plan for the foreseeable future without Huawei and this just makes any reentry to the market even less likely for the company,” he commented. 

“The new fines announced today for operators that are not meeting standards are another major financial incentive to get security in order. The security obligations - which include rules on who has access to sensitive parts of the "core" network, how security audits were conducted, and protecting customer data - will force operators to improve their security protection for the whole network rather than just 5G.”

In addition to the ongoing security concerns surrounding Huawei, which Parliament still views as a state asset of the Chinese Government, the Department for Digital, Culture, Media & Sport cited a report conducted last year by the government, which found that mobile operators were not sufficiently incentivised to adopt the best security practices. 

The Government has also said that it will grant UK watchdog Ofcom broad powers to direct telecom operators to take “interim steps” during the implementation process.